Home / Vulnerability Intelligence / CVE-2026-32993

CVE-2026-32993 - Vulnerability Analysis

HighCVSS: 8.3

Last Updated: May 14, 2026

Unknown Product - HTTP Header Injection

Published: May 13, 2026Updated: May 14, 2026Remote Exploitable

Overview

An unspecified vendor product contains an HTTP header injection caused by improper sanitization of the "status" query parameter in the /unprotected/nova_error endpoint, letting unauthenticated attackers inject arbitrary HTTP headers.

Severity & Score

Severity: High

CVSS Score: 8.3

EPSS Score: 6.6%(Probability of exploitation in next 30 days)

Impact

Unauthenticated attackers can inject arbitrary HTTP headers, potentially leading to cache poisoning or security bypass.

Mitigation

Update to the latest version or apply patches that sanitize the "status" parameter properly.

References

https://support.cpanel.net/hc/en-us/articles/40437313190295-Security-CVE-2026-32993-cPanel-WHM-WP2-Security-Update-May-13-2026

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

May 14, 2026

🟠 CVE-2026-32993 - High (8.3) Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32993/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

May 14, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-32993
Severity: High
CVSS Score: 8.3
Type: crlf_injection
Status: rejected
EPSS: 6.6%
Social Posts: 2

CWE

CWE-93

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS Score

6.6%Probability of exploitation in the next 30 days